Detects links in the body of an email where the linked domain is less than 10 days old from first-time senders.

Detects inbound emails where the sender domain is less than 10 days old from first-time senders.

Detects messages from a mismatched newly registered Reply-to domain that contain a financial or urgent request, or a request and an NLU tag with medium to high confidence, from first time sender. This technique is typically observed in Vendor impersonation.